SG-074: Subcommand chain overflow

Severity: HIGH

Bash command chains >=40 subcommands; overflows MAX_SUBCOMMANDS_FOR_SECURITY_CHECK so deny-list rules never see the tail.

Fires when

• A single bash line chains 40 or more subcommands using `;`, `&&`, or `||`.
• The overflow pushes commands past Claude Code's MAX_SUBCOMMANDS_FOR_SECURITY_CHECK so the deny-list never inspects the tail.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://labs.reversec.com/posts/2026/05/skill-issues-compromising-claude-code-with-malicious-skills-agents-part-1